[feature] Miro: boards-only OAuth scopes for non-Enterprise accounts #2377

The problem

The official @executor.sh/miro catalog app requests boards:read, boards:write, organizations:read, organizations:teams:read, and organizations:teams:write together. The organization scopes require Miro Enterprise access, so a non-Enterprise user who only wants board tools cannot authorize this scope set.

References:

• Miro scope reference
• Miro staff answer about Enterprise scopes and non-Enterprise accounts
• Published Miro catalog source

Proposed shape

Offer an explicit boards-only connection option requesting boards:read and boards:write, alongside the existing full-scope connection. The boards-only option should expose the operations its scopes permit, without offering organization administration that requires Enterprise scopes. Existing full-scope connections should keep their behavior.

If scope profiles require separate provider methods or hosted-client matching, keep that choice explicit in the connection UI. Do not silently reduce an existing connection's permissions or promise tools the selected scopes cannot authorize. Provider plan and administrator restrictions still apply.

Alternatives

Keep the official app unchanged and show its Enterprise account prerequisite before connection. That is the current integration approach; a boards-only option would expand access for users who do not need organization tools.

Where it belongs

The Miro catalog app and its OAuth connection choices. Related hosted OAuth metadata is proposed in #2366 .

Before you submit

• I searched the open issues for a duplicate. The existing Miro MCP OAuth report concerns token validation, rather than the REST catalog app's scope choice.